*/

import type { IncomingMessage, ServerResponse } from "node:http";

import {

asDateTimestampMs,

resolveExpiresAtMsFromDurationMs,

} from "openclaw/plugin-sdk/number-runtime";

import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";

import { isPrivateNetworkOptInEnabled } from "openclaw/plugin-sdk/ssrf-runtime";

import type { ResolvedMattermostAccount } from "../mattermost/accounts.js";

}

function sweepCommandValidationFailureCache(now = Date.now()): void {

const validNow = asDateTimestampMs(now);

if (validNow === undefined) {

commandValidationFailureCache.clear();

return;

}

for (const [key, entry] of commandValidationFailureCache) {

if (entry.expiresAt <= now) {

const expiresAt = asDateTimestampMs(entry.expiresAt);

if (expiresAt === undefined || expiresAt <= validNow) {

commandValidationFailureCache.delete(key);

}

}

function hasCachedCommandValidationFailure(key: string, now = Date.now()): boolean {

sweepCommandValidationFailureCache(now);

const validNow = asDateTimestampMs(now);

if (validNow === undefined) {

return false;

}

const cached = commandValidationFailureCache.get(key);

if (!cached) {

return false;

}

if (cached.expiresAt > now) {

const expiresAt = asDateTimestampMs(cached.expiresAt);

if (expiresAt !== undefined && expiresAt > validNow) {

return true;

}

commandValidationFailureCache.delete(key);

return false;

}

function cacheCommandValidationFailure(key: string, accountId: string): void {

sweepCommandValidationFailureCache();

const now = Date.now();

sweepCommandValidationFailureCache(now);

const expiresAt = resolveExpiresAtMsFromDurationMs(COMMAND_VALIDATION_FAILURE_CACHE_MS, {

nowMs: now,

});

if (expiresAt === undefined) {

commandValidationFailureCache.delete(key);

return;

}

commandValidationFailureCache.set(key, {

accountId,

expiresAt: Date.now() + COMMAND_VALIDATION_FAILURE_CACHE_MS,

expiresAt,

});

}

function sweepCommandValidationLookupRateLimit(now = Date.now()): void {

const validNow = asDateTimestampMs(now);

if (validNow === undefined) {

commandValidationLookupRateLimit.clear();

return;

}

const staleAfterMs = COMMAND_VALIDATION_LOOKUP_REFILL_MS * COMMAND_VALIDATION_LOOKUP_BURST * 2;

for (const [key, entry] of commandValidationLookupRateLimit) {

if (now - entry.updatedAt > staleAfterMs) {

const updatedAt = asDateTimestampMs(entry.updatedAt);

if (updatedAt === undefined || validNow - updatedAt > staleAfterMs) {

commandValidationLookupRateLimit.delete(key);

}

}

accountId: string;

now?: number;

}): { allowed: true } | { allowed: false; shouldLog: boolean } {

const now = params.now ?? Date.now();

const rawNow = params.now ?? Date.now();

const now = asDateTimestampMs(rawNow);

if (now === undefined) {

commandValidationLookupRateLimit.clear();

return { allowed: true };

}

sweepCommandValidationLookupRateLimit(now);

const existing = commandValidationLookupRateLimit.get(params.key);

if (!existing) {